Description
HCL BigFix AEX is affected by a Clickjacking vulnerability, which could allow an attacker to embed the application within a malicious web page or iframe and trick users into performing unintended actions, potentially leading to unauthorized transactions or changes to their accounts.
Published: 2026-10-28
Score: 6.4 Medium
EPSS: n/a
KEV: No
Impact: Clickjacking
Action: Apply Patch
AI Analysis

Impact

HCL BigFix AEX contains a clickjacking flaw that permits an attacker to embed the application within a malicious web page or iframe. By doing so, users may be tricked into performing unintended actions, potentially resulting in unauthorized transactions or changes to their accounts.

Affected Systems

HCL Software BigFix AEX is affected. No specific version information is provided.

Risk and Exploitability

The vulnerability receives a CVSS score of 6.4, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, so no confirmed exploits are known. The likely attack vector is client‑side: a malicious webpage must host the vulnerable application in an iframe, requiring the victim to visit that page and interact with it. Given the need for user interaction, the risk of widespread exploitation is moderate but cannot be ruled out in environments where users regularly access untrusted web content.

Generated by OpenCVE AI on October 28, 2026 at 13:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or upgrade to the latest BigFix AEX version as detailed in the HCL support article.
  • Configure the web application to send the HTTP header X-Frame-Options with the value SAMEORIGIN or DENY, preventing it from being framed by external pages.
  • Monitor user activity logs for unexpected changes or unauthorized transactions and implement user‑education campaigns to warn about suspicious iframe sites.

Generated by OpenCVE AI on October 28, 2026 at 13:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description HCL BigFix AEX is affected by a Clickjacking vulnerability, which could allow an attacker to embed the application within a malicious web page or iframe and trick users into performing unintended actions, potentially leading to unauthorized transactions or changes to their accounts.
Title HCL BigFix AEX is affected by multiple security vulnerabilities.
Weaknesses CWE-1021
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: HCL

Published:

Updated: 2026-10-28T12:25:55.234Z

Reserved: 2026-07-28T13:24:14.282Z

Link: CVE-2026-67079

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-28T13:17:08.743

Modified: 2026-10-28T14:05:59.757

Link: CVE-2026-67079

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T13:30:20Z

Weaknesses
  • CWE-1021

    Improper Restriction of Rendered UI Layers or Frames